Client-Side Probing of Deleted Ridge Statistics in Federated Unlearning

2026-09-03

AI Summary

研究解决了联邦遗忘中客户端数据删除后可能被恢复的问题，通过分析广播更新揭示隐藏摘要的方法，并提出基于攻击者数据的估计器。

Abstract

Federated unlearning aims to remove a client's data from a shared model without retraining from scratch. Some efficient systems make deletion exact by storing compact, additive summaries of the training features and broadcasting an updated linear classifier after every accepted change. We show that these broadcasts can also reveal the hidden summaries. A malicious client can submit known changes, use the returned classifiers to identify the server state, and compare states immediately before and after an isolated deletion. This exposes the deleted sample, class, or client summary and can enable its reinsertion. We characterize exactly when the observations contain enough independent information, give a matching optimal construction for unrestricted probes, and derive a more realistic estimator based on additions formed from the attacker's own data. On MNIST and CIFAR-10, high-precision broadcasts permit exact label recovery for every tested sample deletion with both probe types. Lower-precision broadcasts sharply reduce fine-grained recovery, and insufficiently diverse responses prevent identification altogether. Unrestricted probes are readily detected by their size; most individual attacker-data additions resemble honest batches, although we do not claim that the complete sequence is inconspicuous. The results identify a concrete privacy and integrity risk, its algebraic cause, and practical limits involving broadcast precision, update verification, response rate, and concurrent activity.

Problem

• Federated Unlearning
• Privacy
• Data Deletion
• Server State
• Classifier Broadcast

Innovation

• Federated Unlearning
• Privacy Risk
• Linear Classifier Updates
• Data Recovery
• Broadcast Precision